Stupid ebay trick

[jdow <jd...@earthlink.net>]

From: "eBay" <xs...@aol.com>

Many MUAs will display simply "ebay". If you've not had your first morning
cuppa "stuff" you might be tempted to click on it if it escapes other spam
rules as this list of cell phones for sale did. So I decided to nail the
sucker to the wall if it's ever tried on me again whether or not the
purported xsantal01MUNG@aol.com actually exists.

===8<--- This set of rules nails it cold.
header JD_SIMPLE_EBAY_SPOOFa    From =~ /(\"|\.|\b)ebay(\"|\.|\b)/i
describe JD_SIMPLE_EBAY_SPOOFa  From includes ebay
score JD_SIMPLE_EBAY_SPOOFa     0.01

header JD_SIMPLE_EBAY_SPOOFb    From =~ /\@ebay\.com/i
describe JD_SIMPLE_EBAY_SPOOFb  From includes ebay.com
score JD_SIMPLE_EBAY_SPOOFb     0.01

meta JD_SIMPLE_EBAY_SPOOF       JD_SIMPLE_EBAY_SPOOFa && !JD_SIMPLE_EBAY_SPOOFb
describe JD_SIMPLE_EBAY_SPOOF   From ebay but not from ebay.com
score JD_SIMPLE_EBAY_SPOOF      10
===8<---

(It's not properly "MUNGE". "MUNG" came from "Make USeless and No Good".
I'm feeling pedantic this morning.)

{^_-}